Read the docs
TI-2026-20650 Aliases CVE-2026-25541GHSA-434x-w66g-qw3r

Bytes is vulnerable to integer overflow in BytesMut::reserve

Priority MEDIUM 58CWE-680Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00601 49th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed bytes (tokio-rs): 1.11.1bytes (crates.io): 1.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tokio-rsbytes1.2.1 to before 1.11.11.11.1Patch availableCNA
—bytes (crates.io)1.2.1 to before 1.11.11.11.1Patch availableGHSA-434x-w66g-qw3r
  • bytes Vendortokio-rs Affected 1.2.1 to before 1.11.1 Fixed in 1.11.1 Patch available CNA
  • bytes (crates.io) Vendor— Affected 1.2.1 to before 1.11.1 Fixed in 1.11.1 Patch available GHSA-434x-w66g-qw3r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tokio-rs:bytes:*:*:*:*:*:rust:*:*1.2.1 to before 1.11.1Vulnerabletokio-rs
  • cpe:2.3:a:tokio-rs:bytes:*:*:*:*:*:rust:*:* Versions 1.2.1 to before 1.11.1 Vulnerable ·tokio-rs

Remediation

  • Fix · CNA bytes (tokio-rs) Fixed in 1.11.1
  • Fix · GHSA-434x-w66g-qw3r bytes (crates.io) Fixed in 1.11.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25541
  2. 2026-10-03 Alias added: GHSA-434x-w66g-qw3r

References

Exploit 2

Patch 1

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences